PHP2Shell patches are out (Oct 21, 2026): 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35. See what to do
KALSTRIKEOPS
Critical PHP vulnerability remediation & modernization

Forward-deployed engineers. Rapid PHP2Shell response.

We find every PHP runtime you own, patch CVE-2026-109618 and CVE-2026-109619 with minimal downtime, prove the fix landed, and hand you a plan for the legacy systems that can't wait for the next one.

Request emergency response Check my PHP version
Unauthenticated RCECVSS v4.0 9.2Exploitation attempts observed
Free exposure check

Is your PHP version vulnerable?

Type the version from php -v or your hosting panel. Nothing is sent anywhere — the check runs in your browser.

Tip: running a distro build (Ubuntu, Debian, RHEL, AlmaLinux)? Your vendor may have backported the fix — the number alone can't confirm it.

The short answer

What is PHP2Shell?

PHP2Shell is the name for two critical flaws in the PHP engine itself — CVE-2026-109618 and CVE-2026-109619 — patched on October 21, 2026. Both can let an unauthenticated attacker run code on your server with a crafted web request, before your application code executes. Because the bug is in PHP, updating WordPress, Drupal or your framework does not fix it. The PHP runtime has to be patched on every server, container and image.

CVE-2026-109618
Out-of-memory corruptionCleanup after an OOM treats half-initialized request data as valid.
CVE-2026-109619
Stale global stateUse-after-free across requests in the same worker. Also leaks memory.
Severity
CVSS v4.0 9.2Rated by the PHP security team. Early copies circulating with 10.0 were wrong.
Status
Exploit attemptsCloudflare and watchTowr report early attacks; a pre-auth chain has been demonstrated.
Fixed versions

Patch to these releases

BranchFixed inStatus
PHP 8.58.5.12Official fix
PHP 8.48.4.27Official fix
PHP 8.38.3.36Official fix
PHP 8.28.2.35Official fix
PHP 7.4 – 8.1Source backports / vendor packagesEnd-of-life
PHP 5.4 – 7.3None from PHPUpgrade required

Linux distributions and LTS vendors received patches early and may ship the fix under an older version number. Restart every PHP worker after updating.

Who's exposed

Any PHP that serves the web

The PHP security team says every installation serving web requests is at risk. mod_php is the highest risk: a demonstrated exploit fires before any application code runs.

Apache mod_phpPHP-FPMphp-cgiFrankenPHPLiteSpeed WordPressDrupalJoomlaMagentoLaravel & SymfonyCustom PHP appsShared hosting

Can't patch tonight? Reduce exposure.

  • CVE-2026-109618: set an enforced memory_limit=-1 that applications can't override.
  • CVE-2026-109619: set session.upload_progress.enabled=0, and on PHP 8.5 fatal_error_backtraces=0.
  • Restart every PHP worker so the settings take effect.
  • Isolate or take offline internet-facing systems you can't fix yet (CERT-EU, UK NCSC).

These steps reduce risk but don't make a server safe. WAF rules (Cloudflare has shipped some to all plans) only cover traffic that passes through them. Patching is the fix.

How we respond

From exposure to durable fix

Engineers embed with your team, your hosting provider and your vendors. Every step is reversible and written down.

  1. Triage

    Inventory PHP assets, versions, SAPIs and the business-critical systems exposed to the internet.

  2. Verify

    Confirm what hosting providers, distributions and internal teams have actually patched — not what tickets say.

  3. Contain

    Backups, rollback plans, interim hardening and safe maintenance windows before anything changes.

  4. Remediate

    Patch or upgrade runtimes, rebuild containers and images, test integrations, validate service health.

  5. Future-proof

    Retire end-of-life PHP, clean up dependencies, and set up routine maintenance so the next CVE is a non-event.

Engagements

Pick where to start

01 · Know

Exposure Assessment

A fast, evidence-based answer to “are we exposed?” across every environment you run.

  • PHP inventory across servers, containers, hosts
  • Provider and vendor patch confirmation
  • Risk-ranked findings for leadership
Start an assessment
02 · Fix

Emergency Remediation

Forward-deployed engineers patch, rebuild and verify — alongside your team or for you.

  • Coordinated patching and redeploys
  • Compatibility and integration testing
  • Rollback plans and a written remediation record
Request remediation
03 · Last

Modernization Roadmap

For PHP 5.x–8.1 systems with no fix coming: a practical upgrade path and maintenance plan.

  • Legacy PHP and framework upgrades
  • Dependency cleanup
  • Ongoing managed engineering support
Plan modernization

Forward-deployed

We work inside your environment and your change process, not from a ticket queue.

Rollback-first

Nothing ships without a tested way back, so downtime stays minimal.

Evidence you can share

A remediation record for leadership, clients, auditors and insurers: what ran, what changed, what's verified.

Discuss your project

Tell us what you're running

Three quick steps. An engineer — not a sales queue — reads every request and replies with next steps.

  • Emergency patching across many servers or clients
  • Hosting provider says it's patched — you want proof
  • End-of-life PHP with no official fix
  • Agencies managing multiple client environments

Prefer email? team@kalfoundry.com

Step 1 of 3
How urgent is it?
FAQ

PHP2Shell, answered

Straight answers for engineers, IT leads and site owners.

What is PHP2Shell?

Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched October 21, 2026. The PHP security team rates both 9.2 on CVSS v4.0 and says both can allow unauthenticated remote code execution over ordinary web requests.

Which PHP versions fix it?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4–8.1 have no official release: the PHP security team published minimal source backports, and some distributions and LTS vendors ship patched packages. PHP 5.4–7.3 get no fix from the PHP project.

We use WordPress (or Drupal, Joomla, Magento). Are we affected?

Yes — the flaw is in PHP, so the CMS version doesn't matter. Researchers at Calif reported confirmed pre-authentication RCE against specific versions of WordPress, Drupal, Joomla and Magento. Patch the PHP runtime under the site.

Our host says we're patched. How do we know?

Ask which package build is installed and whether PHP workers were restarted afterward. Distribution packages carry the fix under older version numbers, so php -v alone can mislead. Verifying this across providers is the core of our assessment.

Is there a workaround?

Updating is the only complete fix. Interim settings — an enforced memory_limit=-1, session.upload_progress.enabled=0, and on 8.5 fatal_error_backtraces=0, followed by restarting workers — reduce exposure. WAF rules are a stopgap. Systems you can't patch should be isolated or taken offline.

What if we're on PHP 7 or 5?

There is no fix from the PHP project for 5.4–7.3. Options are a vendor-supported LTS build, isolating the system, or upgrading. Our Modernization Roadmap plans that upgrade without a big-bang rewrite.

How fast can StrikeOps start?

Send the form with your urgency and footprint. An engineer reviews every request and replies with a proposed first step — usually an exposure assessment or direct remediation for systems you already know are vulnerable.

Patch safely. Modernize strategically.

Discuss your project
Sources — facts on this page come from the PHP security advisory as reported by:

Last reviewed October 21, 2026.

Discuss your project